prism-mcp-server 20.21.3 → 20.21.4

package/dist/tools/prismInferHandler.js

@@ -30,7 +30,7 @@ import { getEntitlements, clampCeiling, multiTurnPolicy, ABSOLUTE_MULTI_TURN } f
 import { ddLog } from "../utils/ddLogger.js";
 import { stripThink } from "../utils/thinkStrip.js";
 import { passesQualityGate } from "../utils/qualityGate.js";
-import { passesClinicalQualityGate, formatClinicalSections, } from "../utils/clinicalQualityPolicy.js";
+import { passesClinicalQualityGate, clinicalPlanScaffold, formatClinicalSections, } from "../utils/clinicalQualityPolicy.js";
 import { applyDeterministicCodingRepairs, buildCodingRepairPrompt, passesCodingQualityGate, } from "../utils/codingQualityPolicy.js";
 import { checkInputSafety, checkOutputSafety } from "../utils/safetyGate.js";
 import { callLayer1 as defaultCallLayer1, classifyDeterministicLayer1, keywordBackstop, reservedCategory, MAX_CLASSIFIER_PROMPT_LENGTH } from "../utils/layer1.js";
@@ -2018,9 +2018,13 @@ export async function runInfer(args, deps) {
         // their own — never override an explicit instruction.
         // `=== undefined`, not falsy: `system: ""` is a caller explicitly asking
         // for no system prompt, and overriding that is still an override.
-        const effectiveSystem = (resolvedImages?.length ?? 0) > 0 && args.system === undefined
-            ? VISION_SYSTEM_PROMPT
-            : args.system;
+        // A caller's own `system` always wins, including `system: ""`, which is an
+        // explicit request for none. Defaults apply only when it is undefined.
+        const defaultSystem = [
+            (resolvedImages?.length ?? 0) > 0 ? VISION_SYSTEM_PROMPT : undefined,
+            clinicalPlanScaffold(args.prompt),
+        ].filter(Boolean).join("\n\n") || undefined;
+        const effectiveSystem = args.system === undefined ? defaultSystem : args.system;
         // Walk order for images.
         //
         // Smallest-first was tried and REVERTED on 2026-08-15. It is correct
@@ -2299,7 +2303,8 @@ export async function runInfer(args, deps) {
                     const codingGateFailure = !gate.pass &&
                         mode === "code" &&
                         (gate.reason?.startsWith("code_") === true ||
-                            gate.reason?.startsWith("python_") === true);
+                            gate.reason?.startsWith("python_") === true ||
+                            gate.reason?.startsWith("ts_") === true);
                     if (!codingGateFailure)
                         break;
                     const failedReason = gate.reason ?? "code_quality";

package/dist/utils/clinicalQualityPolicy.js

@@ -36,16 +36,16 @@ const OPERATIONAL_DEFINITION_REQUEST_RE = /\boperational(?:ly)?[ -]?(?:defin\w*)
 const CLINICAL_CONTEXT_RE = /\b(aba\b|bcba\b|behaviou?r analyst|functional behaviou?r assessment|\bfba\b|\bbip\b|replacement behaviou?r|target behaviou?r|reinforcement schedule|\bfct\b|\bdro\b|\bdra\b|\bncr\b)/i;
 /** Ordered so the report reads the way a plan is written. */
 const PLAN_SECTIONS = [
-    { name: "operational_definition", pattern: /operational(?:ly)?[ -]?defin|\bdefinition\b[\s\S]{0,80}\b(observable|measurable)\b/i },
-    { name: "function_hypothesis", pattern: /\b(hypothesi[sz]ed function|function of the behaviou?r|maintained by|\ba-?b-?c\b|antecedent[\s\S]{0,40}consequence)\b/i },
-    { name: "antecedent_strategies", pattern: /\b(antecedent (?:strateg|modificat|intervention)|prevention strateg|setting event|environmental modificat)/i },
-    { name: "replacement_behaviour", pattern: /\b(replacement behaviou?r|functional communication training|\bfct\b|alternative behaviou?r|\bdra\b)/i },
-    { name: "consequence_strategies", pattern: /\b(consequence (?:strateg|procedure)|reinforcement (?:schedule|procedure|strateg)|\bdro\b|\bncr\b|extinction)/i },
-    { name: "data_collection", pattern: /\b(data collection|data sheet|measurement (?:system|procedure)|frequency count|partial interval|momentary time sampling|\bioa\b|interobserver)/i },
-    { name: "decision_rules", pattern: /\b(decision rule|mastery criteri|criteri\w+ for (?:change|modificat|advancement)|review (?:schedule|trigger)|plan review)/i },
-    { name: "generalisation_maintenance", pattern: /\b(generali[sz]|maintenance)\b/i },
-    { name: "caregiver_training", pattern: /\b((?:caregiver|staff|parent|family)[ -]?training|train(?:ing)? (?:the )?(?:caregivers?|staff|parents?))/i },
-    { name: "bcba_review_disclaimer", pattern: /\b(reviewed and individuali[sz]ed|credentialed bcba|licensed behaviou?r analyst|must be reviewed)\b/i },
+    { name: "operational_definition", requirement: "an operational definition that is observable and measurable, with examples AND non-examples", pattern: /operational(?:ly)?[ -]?defin|\bdefinition\b[\s\S]{0,80}\b(observable|measurable)\b/i },
+    { name: "function_hypothesis", requirement: "a hypothesised function supported by A-B-C data", pattern: /\b(hypothesi[sz]ed function|function of the behaviou?r|maintained by|\ba-?b-?c\b|antecedent[\s\S]{0,40}consequence)\b/i },
+    { name: "antecedent_strategies", requirement: "antecedent and prevention strategies", pattern: /\b(antecedent (?:strateg|modificat|intervention|procedure|support)|prevention strateg|proactive strateg|pre-?work strateg|pre-?correct|setting event|environmental modificat|visual (?:schedule|timer|cue)|priming)/i },
+    { name: "replacement_behaviour", requirement: "a functionally equivalent replacement behaviour", pattern: /\b(replacement behaviou?r|functional communication training|\bfct\b|alternative behaviou?r|\bdra\b)/i },
+    { name: "consequence_strategies", requirement: "consequence strategies, including what reinforces the replacement", pattern: /\b(consequence|reinforcement (?:schedule|procedure|strateg|plan|system|for\b)|reinforc\w+ the (?:replacement|desired|appropriate|target)|planned ignoring|response to (?:the )?behaviou?r|redirect\w*|\bpraise\b|\bdro\b|\bncr\b|extinction)/i },
+    { name: "data_collection", requirement: "a data collection method", pattern: /\b(data collection|data sheet|measurement (?:system|procedure)|frequency count|partial interval|momentary time sampling|\bioa\b|interobserver)/i },
+    { name: "decision_rules", requirement: "decision rules and a review schedule", pattern: /\b(decision rule|mastery criteri|criteri\w+ for (?:change|modificat|advancement)|evaluation criteri|review (?:schedule|trigger|date)|plan review|progress monitor\w*|plan will be (?:adjusted|modified|revised|changed))/i },
+    { name: "generalisation_maintenance", requirement: "generalisation and maintenance", pattern: /\b(generali[sz]|maintenance)\b/i },
+    { name: "caregiver_training", requirement: "caregiver and staff training", pattern: /\b((?:caregiver|staff|parent|family|teacher|team)[ -]?training|train(?:ing|ed)? (?:the )?(?:caregivers?|staff|parents?|team)|(?:staff|caregivers?|parents?|team|teachers?)\b[^.\n]{0,30}\btrain\w+|train\w+ on the plan)/i },
+    { name: "bcba_review_disclaimer", requirement: "a statement that a credentialed BCBA must review and individualise the plan before implementation", pattern: /\b(reviewed and individuali[sz]ed|credentialed bcba|licensed behaviou?r analyst|must be reviewed)\b/i },
 ];
 /**
  * AAC access may never be removed, withheld or delayed as a consequence.
@@ -102,6 +102,58 @@ function aacRestrictedAsConsequence(output) {
     }
     return false;
 }
+/** Characters of real prose required near a section marker for it to count. */
+const SECTION_CONTENT_CHARS = 30;
+const SECTION_WINDOW = 400;
+/** Drop whole heading lines. Stripping only the `#` turns the NEXT heading into
+ *  prose, which is why ten empty headings first scored 8 of 10. */
+function proseOnly(text) {
+    return text
+        .split("\n")
+        .filter(line => !/^\s*#{1,6}\s/.test(line)) // markdown headings
+        .filter(line => !/^\s*\*\*[^*]+\*\*\s*:?\s*$/.test(line)) // bold-only lines
+        .join(" ")
+        .replace(/[>#*_|]+/g, "")
+        .replace(/\[[^\]]*\]/g, "") // [placeholders]
+        .replace(/[-\s]+/g, " ")
+        .trim();
+}
+/**
+ * A section counts only when there is real prose NEAR its marker.
+ *
+ * Without this, ten empty headings scored 8 of 10: an output with no clinical
+ * content looked nearly complete, because the census matched vocabulary rather
+ * than substance. The scaffold already demands "substantive content rather than
+ * a heading alone"; this is the census checking the same thing.
+ *
+ * The window spans both directions. A first version looked only forward and
+ * dropped a legitimate credit — "we will write down how often it happens on a
+ * data sheet" puts the content BEFORE the keyword.
+ *
+ * Two limits, both measured rather than assumed.
+ *
+ * The window is wide, so in a dense document a marker finds prose belonging to
+ * a NEIGHBOURING section and is credited for it. This is therefore closer to a
+ * document-level check than a per-section one; what it reliably catches is the
+ * empty or near-empty output, which is what it was added for.
+ *
+ * And a model that echoes the section list back as prose still scores full
+ * marks, because a description of what a plan must contain is, at this level of
+ * analysis, indistinguishable from a plan. That is a limit of the approach, not
+ * something to regex away, and one more reason nothing here is an endorsement.
+ *
+ * The floor is deliberately low. At 50 characters a legitimately terse section
+ * — "Frequency count / Daily tally / Weekly IOA" — was refused, and a false
+ * negative on real content is the more expensive error for a gap report.
+ */
+function sectionHasContent(output, pattern) {
+    const m = new RegExp(pattern.source, pattern.flags.replace("g", "")).exec(output);
+    if (!m)
+        return false;
+    const at = m.index ?? 0;
+    const window = output.slice(Math.max(0, at - SECTION_WINDOW), at + m[0].length + SECTION_WINDOW);
+    return proseOnly(window).length >= SECTION_CONTENT_CHARS;
+}
 /**
  * Raise-only structural check. `pass: true` means nothing was detected as
  * missing — it is not a clinical endorsement.
@@ -127,7 +179,9 @@ export function passesClinicalQualityGate(prompt, output) {
     }
     if (!CLINICAL_PLAN_REQUEST_RE.test(prompt))
         return { pass: true };
-    const missing = PLAN_SECTIONS.filter(s => !s.pattern.test(output)).map(s => s.name);
+    const missing = PLAN_SECTIONS
+        .filter(s => !sectionHasContent(output, s.pattern))
+        .map(s => s.name);
     const sections = {
         required: PLAN_SECTIONS.length,
         present: PLAN_SECTIONS.length - missing.length,
@@ -150,3 +204,42 @@ export function formatClinicalSections(s) {
     const base = `clinical_sections=${s.present}/${s.required}`;
     return s.missing.length ? `${base} missing:${s.missing.join(",")}` : base;
 }
+/**
+ * A system instruction naming every section a plan must contain, generated from
+ * PLAN_SECTIONS so the list that INSTRUCTS is the list that VERIFIES.
+ *
+ * Measured on prism-coder:9b: the same plan request scored 7/10 unscaffolded and
+ * 10/10 scaffolded, in FEWER characters — it restructured rather than padded,
+ * and the previously absent sections came back with substantive content
+ * (a real observable definition with non-examples, real generalisation content,
+ * a correctly worded review statement).
+ *
+ * KNOWN EPISTEMIC COST, recorded rather than hidden: once the model is told the
+ * list, the census stops being independent confirmation and becomes a check
+ * that the instruction was followed. A scaffolded 10/10 is weaker evidence than
+ * an unscaffolded one. Sharing one list is still the right trade — two lists
+ * drift, and a census that disagrees with the instruction is worse than a
+ * census that merely confirms it — but nothing here should be read as evidence
+ * that the model knows what a plan needs.
+ *
+ * LOCAL ONLY. `callCloud` takes the prompt and no system argument, so nothing
+ * here reaches an escalated request — true of VISION_SYSTEM_PROMPT as well, and
+ * pre-existing rather than introduced with this scaffold. The consequence is
+ * that a cloud-served plan is measured by the census WITHOUT having been given
+ * the list, so it can score lower than a local one for reasons that have
+ * nothing to do with the model. Threading `system` through the portal API is
+ * the real fix and is deliberately out of scope here.
+ *
+ * Returns undefined unless a full plan was requested, so it never touches the
+ * prompt for ordinary work.
+ */
+export function clinicalPlanScaffold(prompt) {
+    if (!CLINICAL_PLAN_REQUEST_RE.test(prompt))
+        return undefined;
+    const items = PLAN_SECTIONS.map(s => `- ${s.requirement}`).join("\n");
+    return ("A behaviour plan must contain all of the following, each with substantive "
+        + "content rather than a heading alone:\n" + items
+        + "\n\nUse least restrictive, dignity-preserving, function-based procedures. "
+        + "Never restrict, remove or delay access to an AAC or communication device "
+        + "as a consequence.");
+}

package/dist/utils/codingQualityPolicy.js

@@ -304,7 +304,98 @@ function pythonStaticContractFailure(code) {
         ? `python_static_contract:${[...issues].sort().join(",")}`
         : undefined;
 }
+/**
+ * A generic used with no type argument, e.g. `Map<string, Array>`.
+ *
+ * prism-coder:9b emits this repeatedly — observed in four separate generations
+ * of the same EventEmitter task — and it is a hard compile error (TS2314), so
+ * the file never builds. Detecting it needs no TypeScript dependency: the shape
+ * is unambiguous when the bare name sits inside a type-argument list or
+ * directly after a type annotation.
+ *
+ * Deliberately narrow. Prose mentioning "the Array, then the Map" must not
+ * match, so a bare name is only a finding when it is syntactically in a type
+ * position; a bare `Promise` as a lone return type with no delimiter after it
+ * is missed, which is the conservative direction.
+ */
+const TS_GENERIC = "(?:Array|Map|Set|Promise|Record|Partial|Readonly|WeakMap|WeakSet)";
+const TS_BARE_GENERIC_RE = new RegExp(`<[^<>]*\\b${TS_GENERIC}\\b(?!\\s*<)[^<>]*>` +
+    `|:\\s*${TS_GENERIC}\\b(?!\\s*<)\\s*[={;,)\\]]`);
+/** Null when the code carries no TypeScript static-contract defect. */
+function tsStaticContractFailure(code) {
+    return TS_BARE_GENERIC_RE.test(code) ? "ts_static_contract:bare_generic" : null;
+}
+/** Character ranges a repair must not touch on one line.
+ *
+ *  Strings, because rewriting `"use Map<string, Array> carefully"` changes a
+ *  RUNTIME VALUE rather than a type. And comments, because `// don't use a bare
+ *  Map<string, Array>` is a warning against the very thing the repair would
+ *  write, so editing it inverts the author's meaning. Both found in review. */
+function protectedSpans(line) {
+    const spans = [];
+    const strings = /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`/g;
+    for (const m of line.matchAll(strings))
+        spans.push([m.index ?? 0, (m.index ?? 0) + m[0].length]);
+    // A line comment runs to end of line. An apostrophe in prose ("don't")
+    // breaks the string scan, which is how comments slipped through before.
+    const comment = /\/\/|\/\*/.exec(line);
+    if (comment)
+        spans.push([comment.index, line.length]);
+    return spans;
+}
+/** Fence languages whose contents are TypeScript. A bare generic inside a
+ *  python or json block is not a type error to fix — the first version rewrote
+ *  a comment inside a python block in a multi-language answer. */
+const TS_FENCE_LANG = /^\s*```\s*(ts|typescript|tsx)?\s*$/i;
+/** `Map<string, Array>` -> `Map<string, Array<any>>`, within code only.
+ *
+ *  `any` rather than `unknown` on purpose: `unknown` makes the file compile and
+ *  then breaks every use of the value, which trades one compile error for
+ *  several. This makes the code build; it does not make it well typed.
+ *
+ *  Scoped twice, both from adversarial review. Fenced output is repaired only
+ *  INSIDE its fences, because rewriting the surrounding prose inverts sentences
+ *  like "do not write Map<string, Array>". And no match inside a string literal
+ *  is touched, because that is a value, not a type. */
+function repairBareGenerics(code) {
+    let changed = false;
+    const spanRe = new RegExp(TS_BARE_GENERIC_RE.source, "g");
+    const repairLine = (line) => {
+        const off_limits = protectedSpans(line);
+        return line.replace(spanRe, (span, offset) => {
+            if (off_limits.some(([a, b]) => offset >= a && offset < b))
+                return span;
+            const fixed = span.replace(new RegExp(`\\b(${TS_GENERIC})\\b(?!\\s*<)`, "g"), "$1<any>");
+            if (fixed !== span)
+                changed = true;
+            return fixed;
+        });
+    };
+    const lines = code.split("\n");
+    const hasFences = /^\s*```/m.test(code);
+    let inFence = false;
+    let fenceIsTs = false;
+    const out = lines.map((line) => {
+        if (/^\s*```/.test(line)) {
+            if (!inFence)
+                fenceIsTs = TS_FENCE_LANG.test(line);
+            inFence = !inFence;
+            return line;
+        }
+        // No fences at all: the whole output is the code block.
+        return (!hasFences || (inFence && fenceIsTs)) ? repairLine(line) : line;
+    });
+    return { code: out.join("\n"), changed };
+}
 export function applyDeterministicCodingRepairs(output, reason) {
+    if (reason.startsWith("ts_static_contract:")) {
+        if (!reason.includes("bare_generic"))
+            return { output, changes: [] };
+        const repaired = repairBareGenerics(output);
+        return repaired.changed
+            ? { output: repaired.code, changes: ["bare_generic"] }
+            : { output, changes: [] };
+    }
     if (!reason.startsWith("python_static_contract:")) {
         return { output, changes: [] };
     }
@@ -369,6 +460,9 @@ export function passesCodingQualityGate(prompt, output) {
         if (pythonFailure)
             return { pass: false, reason: pythonFailure };
     }
+    const tsFailure = tsStaticContractFailure(code);
+    if (tsFailure)
+        return { pass: false, reason: tsFailure };
     return { pass: true };
 }
 const CODING_REPAIR_SYSTEM_INSTRUCTION = "Repair the supplied implementation. Return one complete replacement implementation with no prose, " +
@@ -383,6 +477,7 @@ const CODING_REPAIR_GUIDANCE = {
     python_method_missing_receiver: "Instance methods must take self first; class methods must take cls first unless decorated staticmethod.",
     python_undefined_private_helper: "Define every directly called private self helper or replace the call with the correct defined helper.",
     constructor_attribute_missing_receiver: "In __init__, persist instance state as self.<attribute>; do not assign it to a discarded local variable.",
+    bare_generic: "Every generic needs its type argument: write Array<T>, Map<K, V>, Set<T>, Promise<T> — never a bare Array, Map, Set or Promise in a type position.",
     dict_keys_unpack: "When unpacking key and value, iterate dictionary .items(); .keys() yields one key per iteration.",
 };
 function repairGuidance(reason) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.3",
+  "version": "20.21.4",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",